Blog Post

Ask the Directory Services Team
3 MIN READ

Renew Certificate Authority Certificates on Windows Server Core. No Problem!

JIMT05's avatar
JIMT05
Icon for Microsoft rankMicrosoft
Dec 18, 2023
Hi there!  Rob and Jim are here from the Directory Services team.  Today’s blog strives to clearly elucidate an administrative procedure that comes along more frequently with PKI Hierarchies being de...
Updated Dec 12, 2023
Version 1.0
CA Certificate Renewal
Core
Jim Tierney
PKI
Rob Greene
MartinN1983's avatar
MartinN1983
Copper Contributor
Feb 06, 2025

Hi,

After renewing the subordinate issuing CA do I need to run the below command in order to distribute it?

certutil -f -dspublish “Issuing CA1_2025.cer” SubCA

Many Thanks

Savannah_Greene's avatar
Savannah_Greene
Icon for Microsoft rankMicrosoft
Feb 06, 2025

Hey Martin,

 

So if you are logged in as an Enterprise Admin when doing the renewal and we are talking about an Enterprise certification authority then no you would not need to publish the certificate manually.

However if you are NOT logged in as an Enterprise Admin during the renewal, or the it is NOT an Enterprise CA then yes you would and should publish the certificate via the CertUtil command.  However you WILL need to be logged in as an Enterprise Admin when you run the command in order for it to be successful.

Also since you are using a SubCA as your command in above I would say that you would also need to publish the new Issuing CA certificate to the NTAuth store as well.

certutil -f -dspublish “Issuing CA1_2025.cer” NTAuthCA